[SSSD] [PATCH] Ignore referrals when ldap_referrals=false

Jakub Hrozek jhrozek at redhat.com
Wed Aug 20 13:20:56 UTC 2014


Hi,

with the current SSSD code, an LDAP search that results in a referral
fails completely with EIO and usually sends the whole backend to
offline mode. I think this is too strict and if the admin chose to
ignore referrals, we should just skip these results.

John Hodrien in particular was hit by us treating referrals as fatal in
environment where he needs to restrict the search scope by using custom
LDAP search bases.

Also, in cases where Global Catalog support is disabled or GC not available
and a group contains a user from a trusted domain, trying to search for
this DN yields a referral.

Attached is a patch that ignores referrals when the admin set
ldap_referrals=false in the config file.

Given the sdap async code is quite old and I don't remember all the
use-cases, I CC-ed Stephen directly to get some advice. Is there any
risk in ignoring referrals?
-------------- next part --------------
>From a665724aac190ce17295137a3f703f3fce438b70 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Wed, 20 Aug 2014 14:00:38 +0200
Subject: [PATCH] LDAP: Ignore returned referrals if referral support is
 disabled

---
 src/providers/ldap/sdap_async.c | 26 ++++++++++++++++++--------
 src/util/util_errors.c          |  1 +
 src/util/util_errors.h          |  1 +
 3 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/src/providers/ldap/sdap_async.c b/src/providers/ldap/sdap_async.c
index 4100f6d1459907c4e6f7dad492083e2a46d8dd5d..ed20b26fdee63a3a4c749b7941f6d781ae1793ec 100644
--- a/src/providers/ldap/sdap_async.c
+++ b/src/providers/ldap/sdap_async.c
@@ -1421,13 +1421,6 @@ static void sdap_get_generic_ext_done(struct sdap_op *op,
                   sss_ldap_err2string(result), result,
                   errmsg ? errmsg : "no errmsg set");
 
-        if (refs != NULL) {
-            for (i = 0; refs[i]; i++) {
-                DEBUG(SSSDBG_TRACE_LIBS, "Ref: %s\n", refs[i]);
-            }
-            ldap_memvfree((void **) refs);
-        }
-
         if (result == LDAP_SIZELIMIT_EXCEEDED) {
             /* Try to return what we've got */
             DEBUG(SSSDBG_MINOR_FAILURE,
@@ -1448,6 +1441,16 @@ static void sdap_get_generic_ext_done(struct sdap_op *op,
             ldap_memfree(errmsg);
             tevent_req_error(req, ENOTSUP);
             return;
+        } else if (result == LDAP_REFERRAL) {
+            if (refs != NULL) {
+                for (i = 0; refs[i]; i++) {
+                    DEBUG(SSSDBG_TRACE_LIBS, "Ref: %s\n", refs[i]);
+                }
+                ldap_memvfree((void **) refs);
+            }
+            ldap_memfree(errmsg);
+            tevent_req_error(req, ERR_REFERRAL);
+            return;
         } else if (result != LDAP_SUCCESS && result != LDAP_NO_SUCH_OBJECT) {
             DEBUG(SSSDBG_OP_FAILURE,
                   "Unexpected result from ldap: %s(%d), %s\n",
@@ -1610,11 +1613,18 @@ static void sdap_get_generic_done(struct tevent_req *subreq)
 {
     struct tevent_req *req = tevent_req_callback_data(subreq,
                                                       struct tevent_req);
+    struct sdap_get_generic_state *state =
+                tevent_req_data(req, struct sdap_get_generic_state);
     int ret;
 
     ret = sdap_get_generic_ext_recv(subreq);
     talloc_zfree(subreq);
-    if (ret) {
+    if (ret == ERR_REFERRAL) {
+        if (dp_opt_get_bool(state->opts->basic, SDAP_REFERRALS)) {
+            tevent_req_error(req, ret);
+            return;
+        }
+    } else if (ret) {
         DEBUG(SSSDBG_CONF_SETTINGS,
               "sdap_get_generic_ext_recv failed [%d]: %s\n",
                   ret, sss_strerror(ret));
diff --git a/src/util/util_errors.c b/src/util/util_errors.c
index aa5693190ce9a73cd9d46a96d0c071e802a0dff2..5b36780ffcdc6733241cdb942865ecdf38da3bca 100644
--- a/src/util/util_errors.c
+++ b/src/util/util_errors.c
@@ -61,6 +61,7 @@ struct err_string error_to_str[] = {
     { "User/Group SIDs not found" }, /* ERR_NO_SIDS */
     { "Bus method not supported" }, /* ERR_SBUS_NOSUP */
     { "Cannot connect to system bus" }, /* ERR_NO_SYSBUS */
+    { "LDAP search returned a referral" }, /* ERR_REFERRAL */
 };
 
 
diff --git a/src/util/util_errors.h b/src/util/util_errors.h
index f68409eedba0c6cf5d4883c35b59f68deb1d7a01..e040ba903b27d06ec75cea31485d2f3111ca5302 100644
--- a/src/util/util_errors.h
+++ b/src/util/util_errors.h
@@ -83,6 +83,7 @@ enum sssd_errors {
     ERR_NO_SIDS,
     ERR_SBUS_NOSUP,
     ERR_NO_SYSBUS,
+    ERR_REFERRAL,
     ERR_LAST            /* ALWAYS LAST */
 };
 
-- 
1.9.3



More information about the sssd-devel mailing list